Aptoide aptoide.com Aptoide data breach: what happened and what to do
Aptoide, an independent Android app store, was breached in April 2020. About 20 million accounts were exposed: names, email addresses, IP addresses, device details and SHA-1 password hashes without a salt.
View all 13,115 breaches- Breach date
- 13 Apr 2020
- Affected
- 20,012,235
- Data exposed
- Browser user agent details, Email addresses, IP addresses, Names, Passwords
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Aptoide is an independent Android app store. In April 2020 a database of its users was shared online on a hacking forum. Have I Been Pwned (HIBP) counts 20,012,235 affected accounts.
What was exposed
HIBP lists browser user agent details, email addresses, IP addresses, names and passwords stored as SHA-1 hashes without a salt. Reports at the time added registration dates, device details and dates of birth where users had entered them. Unsalted SHA-1 is fast to crack, so many of those passwords can be recovered.
What Aptoide said
Aptoide published a notice after the leak. It said the records covered people who registered or used the store between July 2016 and January 2018, and that people who signed up through Facebook or Google had no passwords in the data. It told users to change their passwords wherever they used the same one. Press reports of the notice described the stored passwords as encrypted, while HIBP's analysis found unsalted SHA-1 hashes.
What it lets criminals do
A name, email address and device details make phishing about app updates or account problems more believable. Cracked passwords can be tried on your email, shopping and social accounts.
What to do
Change any password you used on Aptoide and check for reuse. If you installed apps from the store, review what is on your phone and keep your device up to date.
What to do if you were in it
- 1
Change your Aptoide password
Go to the account settings and pick a new password. If the site is gone or you no longer use it, you can skip this step. If you no longer use the store, still change the password anywhere you reused it.
- 2
Change it everywhere you reused it
Look through your password manager or browser for logins that share the old password and replace each one, starting with email, banking and shopping accounts. Use a different password for every site.
- 3
Turn on two-factor authentication
Use an authenticator app or a hardware key on your email and any account that holds money or personal details. A stolen password alone then isn't enough to get in.
- 4
Expect phishing that uses your email address
Treat unexpected messages about your account, a prize or a password reset with suspicion. Don't click links in them: type the site address yourself or use its app.
- 5
Check whether your email is in this and other breaches
Run a free Serus scan on the email addresses and phone numbers you use. Serus monitors breach databases and the dark web and alerts you when your data shows up, so you hear about the next leak without checking by hand.
Frequently asked
Was I affected by the Aptoide breach?
If you registered with an email address on Aptoide, possibly. Search your email on HIBP to see whether it is in the data.
What was exposed in the Aptoide breach?
Names, email addresses, IP addresses, browser user agent details and SHA-1 password hashes without a salt.
Were Facebook or Google sign-ins affected?
Aptoide said people who signed up with Facebook or Google had no passwords in the leaked data.
Should I change my password after the Aptoide breach?
Yes, on any site where you used the same password, and use a unique one for each account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
